U-Boot Project - CraftedSignal Threat Feed

CVE-2026-29009 - U-Boot Buffer Overflow in nfs_readlink_reply()

hello@craftedsignal.io — Wed, 08 Jul 2026 17:19:10 +0000

U-Boot through 2026.04-rc3 contains a severe buffer overflow vulnerability (CVE-2026-29009) residing within the nfs_readlink_reply() function in net/nfs-common.c. This flaw is exploitable when CONFIG_CMD_NFS is enabled, a common configuration for devices that boot over a network. A malicious or compromised NFS server can exploit this by crafting a sequence of two or more READLINK responses. Each response must contain a relative symlink target approximately 1100 bytes long. When these are appended by the vulnerable U-Boot client without proper cumulative length validation, the 2048-byte nfs_path_buff buffer overflows. This leads to the corruption of adjacent BSS variables, including critical network configuration data like nfs_server_ip, nfs_server_mount_port, nfs_server_port, nfs_our_port, nfs_state, and rpc_id. The consequence is memory corruption and the potential for an attacker to gain control over the U-Boot NFS client's state machine, enabling further compromise of the embedded device or system.

Attack Chain

An attacker compromises or gains control of an NFS server.
A vulnerable U-Boot client, with CONFIG_CMD_NFS enabled, attempts to perform an NFS operation (e.g., read a symlink) from the attacker-controlled NFS server during its boot process.
The attacker's NFS server sends the first READLINK response to the U-Boot client. This response contains a crafted relative symlink target of approximately 1100 bytes.
The U-Boot client's nfs_readlink_reply() function processes this response and appends the symlink target to its internal nfs_path_buff buffer, which has a capacity of 2048 bytes.
The attacker's NFS server then sends a second READLINK response, also containing a relative symlink target of approximately 1100 bytes.
The nfs_readlink_reply() function attempts to append this second symlink target to nfs_path_buff without validating the cumulative length of the appended data.
This second append causes the nfs_path_buff buffer to overflow, corrupting adjacent BSS variables in memory, such as nfs_server_ip, nfs_state, and rpc_id.
The memory corruption provides the attacker with potential control over the U-Boot NFS client's state machine, allowing for manipulation of the boot process or further arbitrary actions.

Impact

Successful exploitation of CVE-2026-29009 can lead to severe memory corruption within the U-Boot environment. Attackers can corrupt critical BSS variables, including network configuration parameters and the internal state of the NFS client. This grants the attacker control over the U-Boot NFS client state machine, potentially allowing them to manipulate the boot process, redirect network traffic, or execute arbitrary code during the initial boot stages. While no specific victim counts or industry sectors are identified in the disclosure, any embedded system or device utilizing U-Boot with NFS boot capabilities enabled is at risk, potentially leading to full device compromise before the main operating system even loads.

Recommendation

Patch CVE-2026-29009 on all affected U-Boot installations immediately.
Review and disable the CONFIG_CMD_NFS option in U-Boot builds if NFS boot functionality is not strictly required.

CVE-2026-29008: U-Boot Integer Underflow Leads to Bootloader Crash

hello@craftedsignal.io — Wed, 08 Jul 2026 17:18:19 +0000

U-Boot versions up to and including 2026.04-rc3 are susceptible to an integer underflow vulnerability (CVE-2026-29008) within the tcp_rx_state_machine() function, located in net/tcp.c. This flaw enables a network-adjacent attacker to trigger a bootloader crash, thereby preventing the device from booting. The attack involves sending a specially crafted TCP SYN+ACK packet where the data offset field is manipulated. This manipulation causes the payload_len variable to become negative. Subsequently, this negative value is implicitly converted into a large unsigned integer when passed to memcpy() within the store_block() function, leading to an excessive memory copy operation and an immediate system crash. If CONFIG_LMB is disabled, this could also result in memory corruption. This vulnerability poses a significant denial-of-service risk for embedded systems utilizing affected U-Boot versions.

Attack Chain

Attacker gains network adjacency to a vulnerable device running U-Boot.
The attacker crafts a malicious TCP SYN+ACK packet.
The data offset field within the crafted TCP SYN+ACK packet is manipulated to an invalid value.
The vulnerable U-Boot bootloader receives the malformed TCP SYN+ACK packet in its tcp_rx_state_machine() function.
During processing, the manipulated data offset causes the payload_len variable to become a negative integer.
The TCP_SYN_SENT handler calls tcp_rx_user_data() without proper tcp_seg_in_wnd() validation for the malformed packet.
The negative payload_len is implicitly converted to a very large unsigned integer, which is then passed to memcpy() in store_block().
The memcpy() operation attempts to copy an excessively large amount of data, resulting in an immediate bootloader crash and device failure to boot, with potential memory corruption if CONFIG_LMB is disabled.

Impact

The successful exploitation of CVE-2026-29008 leads to a denial of service (DoS) by causing the affected U-Boot bootloader to crash. This prevents the device from successfully booting, rendering it inoperable until manual intervention or a power cycle. The vulnerability has a CVSS v3.1 base score of 7.5, indicating a high severity. Furthermore, if the CONFIG_LMB option is disabled, the arbitrary large memcpy() operation could result in memory corruption, potentially leading to further compromise beyond a mere crash, though direct code execution is not explicitly detailed. This impacts embedded devices and systems that rely on U-Boot for their boot process.

Recommendation

Immediately patch U-Boot to a version beyond 2026.04-rc3 to remediate CVE-2026-29008.
Implement network intrusion detection/prevention systems (IDS/IPS) to block malformed TCP SYN+ACK packets, particularly those with anomalous data offset values associated with CVE-2026-29008 exploitation attempts.
Review network firewall rules to ensure only legitimate and properly formed network traffic reaches critical embedded devices running U-Boot.